Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 13 Jul 2016 11:25:58 +1000
From: David Black <>
Subject: CVE request for the Play Framework

In version 2.5.0 of the Play Framework a CSRF bypass that depends upon
an implementation bug in chrome's beacon api[0][1] was fixed.

The issue was that the Play Framework's CSRF implementation could be
bypassed in chrome in certain situations using Beacon requests because
the framework assumed that it is only possible to send what is
considered a simple request cross-domain. In other words the framework
assumed that POST requests with a content-type of
application/x-www-form-urlencoded or text/plain or multipart/form-data
need to have CSRF checks applied and requests with any other
content-type need not be checked.

The Beacon (sendBeacon) implementation
in chrome[0][1] currently allows requests to be sent cross-domain with
non-simple content-types. That is, it is possible to send a post
request with a content-type of "application/json" (or any arbitrary
content type of an attacker's choice) from an attacker's site (e.g. to in chrome through
executing the following javascript:

var payload = '{"key": "value"}';
navigator.sendBeacon('', new Blob([payload], {type:

The fix can be found at in commit

Can a CVE be assigned for this issue?

[0] -
[1] clarified when
implementations of the Beacon API need to first make a CORS preflight
request (when non-simple content-types are sent cross-domain using the
beacon api then a CORS preflight request needs to be sent first).

David Black / Security Engineer.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.